From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id C5B00A0C41; Thu, 4 Nov 2021 15:00:06 +0100 (CET) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id AAB31411C9; Thu, 4 Nov 2021 15:00:06 +0100 (CET) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mails.dpdk.org (Postfix) with ESMTP id 9451C411A4 for ; Thu, 4 Nov 2021 15:00:05 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1636034404; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JRMRAm6Iy1NAwbjBRkTa3BpOLp5+e/LSNDH2ODjxuQc=; b=J4DIsk3JiA9Z5/eJaww9l/jvj6p5Mq6fu3JxnAn4YmFXkkxmwBB3T7mL7hmKJPnYxbALMo AtxNEaorfoO2HqL9vg2BifsF8aTZyw2pCREGeCm7uXZ5g1W4cJHzFHfYa281wRKgsQ8ep7 h++B4rV85G2DAzsGlYGQqc7h8btWz/w= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-177-f-Xeaw67M2iTClhXL_nn3Q-1; Thu, 04 Nov 2021 10:00:03 -0400 X-MC-Unique: f-Xeaw67M2iTClhXL_nn3Q-1 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id D94B98735D8; Thu, 4 Nov 2021 14:00:01 +0000 (UTC) Received: from [10.39.208.16] (unknown [10.39.208.16]) by smtp.corp.redhat.com (Postfix) with ESMTPS id A632170F5E; Thu, 4 Nov 2021 13:59:41 +0000 (UTC) Message-ID: <9cfb072b-5fd7-7c1e-0050-6c18776e1a4c@redhat.com> Date: Thu, 4 Nov 2021 14:59:38 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.2.0 To: David Marchand , dev@dpdk.org Cc: yux.jiang@intel.com References: <20211102184020.438-1-david.marchand@redhat.com> From: Maxime Coquelin In-Reply-To: <20211102184020.438-1-david.marchand@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=maxime.coquelin@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [dpdk-dev] [PATCH] eal/linux: fix uevent message parsing X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" On 11/2/21 19:40, David Marchand wrote: > Caught with ASan: > ==9727==ERROR: AddressSanitizer: stack-buffer-overflow on address > 0x7f0daa2fc0d0 at pc 0x7f0daeefacb2 bp 0x7f0daa2fadd0 sp 0x7f0daa2fa578 > READ of size 1 at 0x7f0daa2fc0d0 thread T1 > #0 0x7f0daeefacb1 (/lib64/libasan.so.5+0xbacb1) > #1 0x115eba1 in dev_uev_parse ../lib/eal/linux/eal_dev.c:167 > #2 0x115f281 in dev_uev_handler ../lib/eal/linux/eal_dev.c:248 > #3 0x1169b91 in eal_intr_process_interrupts > ../lib/eal/linux/eal_interrupts.c:1026 > #4 0x116a3a2 in eal_intr_handle_interrupts > ../lib/eal/linux/eal_interrupts.c:1100 > #5 0x116a7f0 in eal_intr_thread_main > ../lib/eal/linux/eal_interrupts.c:1172 > #6 0x112640a in ctrl_thread_init > ../lib/eal/common/eal_common_thread.c:202 > #7 0x7f0dade27159 in start_thread (/lib64/libpthread.so.0+0x8159) > #8 0x7f0dadb58f72 in clone (/lib64/libc.so.6+0xfcf72) > > Address 0x7f0daa2fc0d0 is located in stack of thread T1 at offset 4192 > in frame > #0 0x115f0c9 in dev_uev_handler ../lib/eal/linux/eal_dev.c:226 > > This frame has 2 object(s): > [32, 48) 'uevent' > [96, 4192) 'buf' <== Memory access at offset 4192 overflows this > variable > HINT: this may be a false positive if your program uses some custom > stack unwind mechanism or swapcontext > (longjmp and C++ exceptions *are* supported) > Thread T1 created by T0 here: > #0 0x7f0daee92ea3 in __interceptor_pthread_create > (/lib64/libasan.so.5+0x52ea3) > #1 0x1126542 in rte_ctrl_thread_create > ../lib/eal/common/eal_common_thread.c:228 > #2 0x116a8b5 in rte_eal_intr_init > ../lib/eal/linux/eal_interrupts.c:1200 > #3 0x1159dd1 in rte_eal_init ../lib/eal/linux/eal.c:1044 > #4 0x7a22f8 in main ../app/test-pmd/testpmd.c:4105 > #5 0x7f0dada7f802 in __libc_start_main (/lib64/libc.so.6+0x23802) > > Signed-off-by: David Marchand > --- > lib/eal/linux/eal_dev.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/lib/eal/linux/eal_dev.c b/lib/eal/linux/eal_dev.c > index 925cdba553..1fd00a482b 100644 > --- a/lib/eal/linux/eal_dev.c > +++ b/lib/eal/linux/eal_dev.c > @@ -160,6 +160,9 @@ dev_uev_parse(const char *buf, struct rte_dev_event *event, int length) > break; > buf++; > } > + if (i >= length) > + break; > + > /** > * check device uevent from kernel side, no need to check > * uevent from udev. > Reviewed-by: Maxime Coquelin Thanks, Maxime